Save but not publish permission

H

hinrgsunshine2

We are rolling out a new system and we've created a project template that
we'd like our project managers to use. We would like them to access the
template, modify it to suit their project and then save it to the server. We
DO NOT want
them to publish task assignments at this time. Is there a way we can
configure permissions to allow them to save but not publish?
 
D

Dale Howard [MVP]

hinrgunshine2 --

Here's how:

1. Log into PWA with administrator permissions.
2. Click Admin - Manage users and groups.
3. Click the Groups link in the sidepane on the left.
4. Select the Project Managers group and click the Modify Group button.
5. In the Categories section, select the My Projects category.
6. In the Permissions grid for the Categories section, make sure the Open
Project and Save Project permissions are set to Allow.
7. In the Global Permissions grid at the bottom of the page, make sure the
New Project permission is set to Allow.
8. In the Global Permissions grid, deselect the Allow permission for the
Publish/update/status permission (and do not select the Deny permission).
9. Click the Save Changes button.

The steps above assume that you have not changed the default permissions in
the Project Managers group. Also, make sure that your PMs are ONLY in the
Project Managers group to confirm that these permissions work. If they are
in other Groups, remove them from those Groups. Hope this helps.
 
H

hinrgsunshine2

ah ha, that is what I did wrong...
I set the Publish/update/status permission to deny. Man, does that create a
mess!

We have changed the PM group from it's default but I see where you're going
with this. Let me give it a try. Thanks!
 
D

Dale Howard [MVP]

hinrgunshine2 --

If a user is a member of multiple security Groups, and you set a Deny
permission in any one of those Groups, Project Server calculates the
cumulative permission for all Groups as follows:

1. Deny trumps Allowed and Not Allowed.
2. Allowed trumps Not Allowed.
3. Not Allowed does not allow the permission unless explicitly granted in
another Group.

If you set that permissions to Deny in the Project Managers group, and YOU
are a member of BOTH the Administrators group and the Project Managers
group, then YOU would not be able to publish a project even though you are
an administrator. That's why setting a Deny permission is so dangerous.
Use the Deny permission only rarely, and in unique situations where you know
the intended result. On Monday, I actually set a Deny permission on the
Project Server 2003 system at a client site, but I know what I was doing, we
tested it thoroughly, and it worked beautifully. But I have only done this
a few times in the past 5 years. Hope this helps.
 
H

hinrgsunshine2

Argh, if I only had your wisdom a couple of months ago!
I'm reviewing the changes we made in the security settings to see
if we have a deny that is preventing us from implementing it the
way you state.

Does the setting in MS Project Pro "On every save, publish the following
information to Project Server" need to be changed?
 
D

Dale Howard [MVP]

hinrgsunshine2 --

If you have that option selected, then I would recommend that your PM's
deselect it. PM's should only publish assignments when they are good and
ready, and should not count on the system doing it for them. In large
projects, the "save and publish every time" option can be very time
consuming! If you have not done so already, I strongly recommend that you
purchase our Administering book for Project Server 2003 administrators,
available for purchase at:

http://www.projectserverbooks.com

The book has a large chapter on configuring security in Project Server and
can help you to restore the system to default settings if you screw things
up. Hope this helps.
 
Top